If that's all it takes to pass their audit, then it's a big joke. No
wonder so much credit card fraud is going on.
So, it's perfectly ok if anyone can execute
select name, mothersmaidenname, ssn, yearlysalary, creditcardnumber from
and see the data as long as, while it's on disk, it's encrypted?